full-disclosure - Re: [ GLSA 200512-04 ] Openswan, IPsec-Tools: Vulnerabilities in ISAKMP Protocol implementation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <43A00C20.9060409@gentoo.org>
Date: Wed Dec 14 12:12:35 2005
From: koon at gentoo.org (Thierry Carrez)
Subject: Re: [ GLSA 200512-04 ] Openswan,
 IPsec-Tools: Vulnerabilities in ISAKMP Protocol implementation

VANHULLEBUS Yvan wrote:

> On Tue, Dec 13, 2005 at 09:49:40PM +0100, Paul Wouters wrote:
> 
>>On Mon, 12 Dec 2005, Thierry Carrez wrote:
>>
>> [...]
>>>Impact
>>>======
>>>
>>>A remote attacker can create a specially crafted packet using 3DES with
>>>an invalid key length, resulting in a Denial of Service attack, format
>>>string vulnerabilities or buffer overflows.
>>
>>That's a copy and paste from the IPsec proto testsuite.
>>
>>1) It conflicts with the above comment that this is only a DOS
>>2) It's incorrect (for openswan)
> 
> Also incorrect for ipsec-tools AFAIK. The only problem we noticed with
> protos testsuite was a lack of verification for some payloads
> existency in aggressive mode.
> 
>>>Workaround
>>>==========
>>>
>>>Avoid using "aggressive mode" in ISAKMP Phase 1, which exchanges
>>>information between the sides before there is a secure channel.
>>
>>In fact, you would to both have aggressive mode enabled AND know the PSK.
>>If you have those two enabled, you are vulnerable to a MITM anyway, since
>>any client knowing the PSK can pretend to be the IPsec security gateway.
> 
> 
> Knowing the PSK is not really needed, as AGGRESSIVE+PSK mode is known
> to be quite unsecure, and can be bruteforced offline.
> 
> The "workaround" for ipsec-tools is to upgrade, and is only needed for
> some people which really have a week configuration and should care
> about lots of potential problems !

Paul, Yvan,

Many thanks for the precisions and sorry for getting it wrong. I'll fix
the GLSA text for Impact and Workaround on the Gentoo website asap.

-- 
Thierry Carrez (Koon)
Gentoo Linux Security
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 256 bytes
Desc: OpenPGP digital signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051214/37462eb4/signature.bin